The present invention relates to a login authentication technique that allows a user who is using a business system to use a commercial service system safely and enables multiple users who are using the business system to share an account of the commercial service system.
At present, a user frequently uses various commercial services via an intranet business system and the Internet at the same time. The intranet business system performs login authentication to enable processing in accordance with the user's official authority. However, if a service via the Internet is charged, the login authentication is required for utilization of the service. The following requirements are provided for utilization of these multiple systems.
(1) When a user uses a commercial service system from inside an enterprise, the user needs not to be aware of the system or service that the user is using. That is, the login authentication of the commercial service system needs not to be performed explicitly.
(2) Because in-house users who can use a commercial service system must be limited in accordance with their official authority, security concerning information (accounting) about login authentication needs also to be considered. That is, even if a password is leaked to another user, the password is rejected by the login authentication.
(3) Because a business system that is already operating and a commercial service may be linked, a load on the business system is minimized.
(4) Because it is mostly unrealistic from the standpoint of accounting that accounts for in-house users who use a commercial service are secured, multiple in-house users can share an account.
To satisfy the requirement (1), a method for transferring a special key generated in accordance with a protocol arranged between a business system and a service system to a client (terminal) is considered so that the commercial service can directly be used from the client. In this case, to satisfy the requirement (2), a fixed user ID and a password in the normal login authentication cannot be used as the key. To realize the above login authentication function, utilization of what is called a one-time password is considered. The prototype of the one-time password is a Lamport's Hash algorithm, and is described in ‘Password Authentication with Insecure Communication’ by Leslie Lamport of “Communications of the ACM, Volume 24, Issue 11 (November 1981)”, pages 770 to 772.